The Hacker News — Cyber Security, Hacking, Technology News

Have you ever felt like wishing of sending any type of file immediately to your friends and office colleagues on WhatsApp directly, instead of just contacts, images or documents?

Well, now you can…

The latest version of WhatsApp for Android and iOS now allows users to send and receive any type of files, whether it’s .mp3, .avi, .php, zip files, or even APKs.

The company last month rolled out this feature to its beta users for Android, and now after being tested successfully, the feature is being released to all WhatsApp users in the latest public update for iOS and Android.

Hackers have obtained credentials for more than 68 Million accounts for online cloud storage platform Dropbox from a known 2012 data breach.

Dropbox has confirmed the breach and already notified its customers of a potential forced password resets, though the initial announcement failed to specify the exact number of affected users.

However, in a selection of files obtained through sources in the database trading community and breach notification service Leakbase, Motherboard found around 5GB of files containing details on 68,680,741 accounts, which includes email addresses and hashed (and salted) passwords for Dropbox users.

An unnamed Dropbox employee verified the legitimacy of the data.

Out of 68 Million, almost 32 Million passwords are secured using the strong hashing function "BCrypt," making difficult for hackers to obtain users' actual passwords, while the rest of the passwords are hashed with the SHA-1 hashing algorithm.

These password hashes also believed to have used a Salt – a random string added to the hashing process to further strengthen passwords in order to make it more difficult for hackers to crack them.

"We've confirmed that the proactive password reset we completed last week covered all potentially impacted users," said Patrick Heim, Head of Trust and Security for Dropbox.

"We initiated this reset as a precautionary measure so that the old passwords from prior to mid-2012 can’t be used to improperly access Dropbox accounts. We still encourage users to reset passwords on other services if they suspect they may have reused their Dropbox password."

Dropbox initially disclosed the data breach in 2012, notifying users that one of its employee passwords was acquired and used to access a file with users’ email addresses, but the company didn't disclose that the hackers were able to pilfer passwords too.

But earlier this week, Dropbox sent out emails alerting its users that a large chunk of its users’ credentials was obtained in 2012 data breach that may soon be seen on the Dark Web marketplace, prompting them to change their password if they hadn't changed since mid-2012.

"Our security teams are always watching out for new threats to our users. As part of these ongoing efforts, we learned about an old set of Dropbox user credentials (email addresses plus hashed and salted passwords) that we believe were obtained in 2012," the company wrote. "Our analysis suggests that the credentials relate to an incident we disclosed around that time."

Dropbox is the latest to join the list of "Mega-Breaches," that revealed this summer, when hundreds of Millions of online credentials from years-old data breaches on popular social network sites, including LinkedIn, MySpace, VK.com and Tumblr, were sold on Dark Web.

The takeaway:

Change your passwords for Dropbox as well as other online accounts immediately, especially if you use the same password for multiple websites.

Also use a good password manager to create complex passwords for different sites as well as remember them. We have listed some best password managers that could help you understand the importance of password manager and choose one according to your requirement.

How many more data dumps does this hacker have with him that has yet to be exposed?

Well, no one knows the answer, but we were recently made aware of another data breach from Peace – the same Russian hacker who was behind the massive breaches in some of the most popular social media sites including LinkedIn, MySpace, Tumblr, and VK.com.

The hacker under the nickname "Peace" (or Peace_of_mind) is now selling over 51 Million records obtained from iMesh – now defunct peer-to-peer file sharing service.

The New York-based iMesh was one of the first and most popular file sharing services that allowed users to share multimedia files with their friends via the peer-to-peer (or P2P) protocol.

Launched in the late 90s, iMesh became the third-largest service in the United States in 2009, but the service was unexpectedly closed down last month.

LeakedSource, a search engine site that indexes leaked login credentials from data breaches, noted in a blog post that the company has obtained the database containing more than 51 Million accounts from iMesh.

The same database has also been made available for sale on The Real Deal Dark Web marketplace by the same hacker that also put up for sale data from LinkedIn, Tumblr, MySpace and Twitter.

Though iMesh stored all passwords in hashed and salted format, the passwords were salted with the MD5 algorithm that is easy to break nowadays.

Based on the most recent records in the leaked database, the data breach search engine estimates the hacker breached iMesh on September 22, 2013.

The database contains 13.7 Million users from the US, around 4 Million from Turkey, over 3.5 Million from the UK, and remaining from other parts of the world. Most iMesh’s users signed up with Hotmail (14.3 Million) and Yahoo (10.5 million) emails, and almost 1 Million users used 123456 as their password.

All the data is now up for sale on the dark web for just 0.5 Bitcoin (nearly US$335), so it's high time you changed your passwords for all social media sites immediately, especially if you use the same password for different websites.

The 38-year-old rapper Kanye West is at the centre of controversy once again.

West is himself a Pirate Lover just like everyone else, and he proved it today by sharing a photo of his laptop screen on Twitter.

The rapper tweeted an ill-judged picture on Tuesday night to show what he was listening to on YouTube (Sufjan Stevens’ 'Death With Dignity' song), but his fans discovered something he would have hide if realized before sharing that snap.

Taking a closer look at the address bar was quite revealing, showing two very interesting tabs:

The notorious file-sharing website The Pirate Bay

MediaDownloader

Pirate Bay Offers Tech Support to Kanye West

West’s recent album The Life of Pablo was involved in a piracy concern. He was so outraged when he saw his recent album was being pirated by 500,000 downloads in just two days that he considered taking legal action against The Pirate Bay.

However, in a recent tweet West accidentally revealed his own pirate habits.

It looks like the controversial rapper was torrenting a pirated copy of Xfer Records synthesizer software Serum on The Pirate Bay. The serum is a popular WaveTable editor that costs just $189 for a license.

However, despite having harsh feelings, the Pirate Bay team said it was happy to provide West with tech support.

DJ Deadmau5, co-founder of Xfer Records, called out West as a dick and later he showed some sympathy for West, calling for a Kickstarter campaign to raise fund to help West afford a copy of Serum.

What do you expect a tech giant to protect your backdoor security with?

Holy Cow! It's "12345678" as a Hard-Coded Password.

Yes, Lenovo was using one of the most obvious, awful passwords of all time as a hard-coded password in its file sharing software SHAREit that could be exploited by anyone who can guess '12345678' password.

The Chinese largest PC maker made a number of headlines in past for compromising its customers security.

Now, Research center of Core Security CoreLabs issued an advisory on Monday that revealed several software vulnerabilities in Lenovo SHAREit app for Windows and Android that could result in:

Information leaks

Security protocol bypass

Man-in-the-middle (MITM) attacks

Critical Vulnerabilities in SHAREit

SHAREit is a free file sharing application that is designed to allow people to share files and folders from Android devices or Windows computers over a local LAN or through a Wi-Fi hotspot that's created.

All the vulnerabilities were remotely exploitable and affected the Android 3.0.18_ww and Windows 2.5.1.1 versions of SHAREit.

Here's the list of four vulnerabilities:

Use of Hard-coded Password [CVE-2016-1491]

Missing Authorization [CVE-2016-1492]

Missing Encryption of Sensitive Data [CVE-2016-1489]

Information Exposure [CVE-2016-1490]

The first vulnerability (CVE-2016-1491) would make you scream… How Dare You!

Using '12345678' as Hard Coded Password

Lenovo was using '12345678' as a hard-coded password in SHAREit for Windows that has been awarded the title of the Third Worst Password of 2015 by the password management firm SplashData.

Here's what Core Security researchers explain:

"When Lenovo SHAREit for Windows is configured to receive files, a Wi-Fi HotSpot is set with an easy password (12345678). Any system with a Wi-Fi Network card could connect to that Hotspot by using that password. The password is always the same."

This is ridiculous especially when the passwords in any application are hard-coded and unchangeable by an average user, putting its consumers and their data at risk.

Other Critical Flaws Left Millions of Users at Risk

However, the issue got worse when the second vulnerability (CVE-2016-1492) came into play. In the second flaw, that applied only to SHAREit for Android, an open WiFi hotspot is created without any password when the app is configured to receive files.

This could have allowed an attacker to connect to that insecure WiFi hotspot and capture the data transferred between Windows and Android devices.

This didn't end here. Both Windows and Android were open to the third flaw (CVE-2016-1489) that involved the transfer of files via HTTP without encryption.

This allowed hackers to sniff the network traffic and view the data transferred or perform Man-in-the-Middle (MitM) attacks in order to modify the content of the transferred files.

Finally, the last but not the least, fourth vulnerability (CVE-2016-1490) discovered by CoreLabs relates to the remote browsing of file systems within Lenovo ShareIt and builds upon the default 12345678 Windows password issue reported above.

"When the Wi-Fi network is on and connected with the default password (12345678), the files can be browsed but not downloaded by performing an HTTP Request to the WebServer launched by Lenovo SHAREit," says the advisory.

Patch Now!

The researchers at Core Security privately reported the flaws to Lenovo back in October last year, but the tech giant took three months to patch the flaws.

Patches for both Android as well as Windows phone are made available on the Google Play Store and here, respectively. So, SHAREit users are advised to update their apps as soon as possible.

The controversial file-sharing website The Pirate Bay will still be running in Sweden as the District Court of Stockholm on Friday ruled that they be unable to force the internet service providers (ISPs) to block the website from operating.

The Pirate Bay is an infamous Swedish search engine predominantly used worldwide for pirating material, such as software, movies, music files and TV shows, entirely free of charge.

Numerous ISPs around Europe block the Pirate Bay, but the notorious site will not be inaccessible in its home country Sweden, at least for now, according to the local media.

Last year, a lawsuit was filed by Warner Music, Sony Music, Universal Music, Nordisk Film and the Swedish Film Industry in order to force Swedish ISP broadband companies to block the Pirate Bay, claiming them liable for the infringements of its customers.

However, the Broadband companies refused to comply, stating that their only role is to provide their clients with access to the Internet while facilitating the free flow of information.

Sweden – We can't Ban The Pirate Bay

Now, a Stockholm District Court has handed down its decision in favor of ISPs, ruling that Sweden can not make them block the access to the Pirate Bay website, as those broadband companies are not responsible for what their customers do.

"A unanimous district court considers, therefore, that it is not in a position to authorize such a ban as the rights holders want, and, therefore, rejects their requests," presiding Chief Magistrate Anders Dereborg said.

In other words, the ISP networks are not participating in any crimes, according to the court ruling, as they are just the delivery medium.

While it is possible that the group representing the copyright holders could appeal a higher court, in the meantime, the group will still have to pay the ISPs legal costs thus far, which amounts to more than $150,000.

So, before the group appeals a higher authority, this is something it might want to reconsider.

Remember RapidShare? Once one of the world's most popular and first ever one-click online file hosting and cloud storage website on the Internet. The company has announced that it will shut down its business at the end of next month.

RapidShare file hosting service announced its shut down Tuesday through a notice on its official website, saying that it will stop active service on March 31, 2015. All user accounts on the website will no longer be available after this date, and all files will be deleted automatically.

WHAT RAPIDSHARE USERS MUST DO ?

"We strongly recommend all customers to secure their data. After March 31st, 2015 all accounts will no longer be accessible and will be deleted automatically," the notice on RapidShare official website reads.

Just two days back, the most popular Torrent website KickAss Torrents banned by the .so registry (Somalian registry), forcing the site's operators to switch to another domain. Now, suddenly the oldest and popular file hosting service is closing up its shop.

RapidShare, founded in May 2002, was widely used to share copyrighted content directly. In 2009, the site claimed to have 10 petabytes of files uploaded to its servers, and in 2010, it was said to have hundreds of millions of visitors per month, making it among the world’s 50 most popular websites.

REASON BEHIND THE SHUT DOWN

The reason behind the sudden shutdown decision is still unclear, however, the legal troubles related to copyright infringement have plagued the company for years.

RapidShare has often been faced several lawsuits just like all other notorious file hosting services including The Pirate Bay, Megaupload and Isohunt, which all have been hit with legal issues for facilitating copyright infringement.

While RapidShare worked to cooperate with the entertainment industry and even tried to rebrand itself as a personal cloud storage service in recent years by introducing a number of measures to discourage infringement. But at the end, its user base fell dramatically. It’s likely the site simply isn't as profitable as it once was.

The reason behind the closure could also be the increasing competition with the other cloud storage services. We know that RapidShare cloud file hosting servers provides unlimited upload and download sizes, but the service does make you wait to download files if you are not its premium user.

Comparatively, RapidShare charges roughly $680 per year for 300GB of space, while Dropbox charges just $99 a year for 1TB.

ONLINE FILE STORAGE SERVICES Vs. COPYRIGHT INFRINGEMENT

MegaUpload, one of the largest file sharing websites on the Internet, was shut down in 2012 by federal prosecutors in Virginia, and the site's founder Kim Dotcom and three others were arrested by the police in New Zealand at the request of US authorities, conspiring to commit copyright infringement.

The same happened in the case of The Pirate Bay — a widely popular torrent download website predominantly used to share copyrighted material free of charge, when TPB went dark from the Internet following a raid in Sweden.

The raid was in response to a complaint from Swedish anti-piracy group Rights Alliance. The police raided The Pirate Bay's server room in Stockholm and seized several servers and other equipment. However, the infamous torrent download website The Pirate Bay (TPB) made a defiant return and finally came back online last weekend.

In spite of all the things smartphones can do, messaging remains one of the most popular activities. Popular messaging apps like WhatsApp, Viber, WeChat support text messages, voice calls, photo & video sharing features, but there is no provision for sharing every file types on these amazing messengers.

But, some or the other day, we all got struck into an awkward situation where we have to share PDF, apk or zip files with our friends while chatting.

However using any other 3rd-party file sharing services, we can share image, video, audio, zip files or any other file type with our friends, but it would be a lengthy process and sometimes require to use computer.

Gone are the days when you relied on your computer to get all of your work done. Telegram Messenger, the most popular and ultra secure messaging application, is now offering file sharing feature that allows its users to share large files and documents (up to 1.5GB) securely.

Telegram is a messaging app that offers end-to-end encryption and also offers a 'Secret Chat' feature, that self-destruct messages after the conversation. The notable thing about Telegram Messenger is that it is free and an open source project, which means that the source code of the project is freely available.

"A huge advantage of Telegram over any other tool is sharing large documents," the company wrote on its blog post Sunday. "You can send files up to 1.5 GB using Telegram and access them from any of your devices. Perfect for everything from studying to sharing personal archives."

This means that now any file we receive in Telegram Messenger can be sent to email or any other apps just by opening the file in the app and tapping on the Share button. Moreover, Android users would be given a 'Share' option in the file's context menu that will help them to share large files with their friends.

This is rather a very handy feature that many Telegram Messenger users might find useful, since most email providers limit the size of files attachment to 25MB. Also, interesting since none of the competitive service — WhatsApp, Viber, Line allow the transfer of non-media files only.

Telegram Messenger is offering, what the company calls, Bonus for iOS users. As the app is now supported in the iOS 8 sharing menu that could be open while users are viewing any document on their iOS devices.

In addition to sharing large files, the new Telegram Messenger update offers Mute Notifications, where users can temporarily mute notifications from particular contacts and groups for 1 hour, 8 hours or 2 days; and Multisearch, where users can get instant results for particular contacts, chats, groups, usernames or messages.

Cryptocat developer's Peerio secure messaging app also offers file sharing, but the app is not widely used by people, as it is available only for Windows, Mac OS X and Chrome, but not for Android and iOS platform. Android and iOS version of apps are in the progress and will be available soon.

Peerio is an "encrypted productivity suite" designed to offer much more usable alternative to PGP email and file encryption, so that every individual user and business can encrypt everything from Instant Messages to online file storage.